---
layout: docs
page_title: Use the Raw Fork/Exec task driver in a job
description: Nomad's Raw Exec task driver lets you execute commands with no resource isolation. Learn how to use the Raw Fork/Exec task driver in your jobs.
---

# Use the Raw Fork/Exec task driver in a job

Name: `raw_exec`

The `raw_exec` driver is used to execute a command for a task without any
isolation. Further, the task is started as the same user as the Nomad process.
As such, it should be used with extreme care and is disabled by default.

Refer to [Configure the Raw Fork/Exec task
driver](/nomad/docs/job-declare/task-driver/raw_exec) for capabilities, client
requirements, and plugin configuration.

## Task configuration

```hcl
task "webservice" {
  driver = "raw_exec"

  config {
    command = "my-binary"
    args    = ["-flag", "1"]
  }
}
```

The `raw_exec` driver supports the following configuration in the job spec:

- `command` - The command to execute. Must be provided. If executing a binary
  that exists on the host, the path must be absolute. If executing a binary that
  is downloaded from an [`artifact`](/nomad/docs/job-specification/artifact), the
  path can be relative from the allocation's root directory.

- `args` - (Optional) A list of arguments to the `command`. References
  to environment variables or any [interpretable Nomad
  variables](/nomad/docs/reference/runtime-variable-interpolation) will be interpreted before
  launching the task.

- `cgroup_v1_override` - (Optional) A map of controller names to paths. The
  task will be added to these cgroups. The task will fail if these cgroups do
  not exist. **WARNING:** May conflict with other Nomad driver's cgroups and
  have unintended side effects.

- `cgroup_v2_override` - (Optional) Adds the task to a unified cgroup path.
  Paths may be relative to the cgroupfs root or absolute.  **WARNING:** May
  conflict with other Nomad driver's cgroups and have unintended side
  effects.

~> On Linux, you cannot set the `task.user` field on a task using the `raw_exec`
driver if you have hardened the Nomad client according to the
[production][hardening] guide. On Windows, when Nomad is running as a [system
service][service], you may specify a less-privileged service user. For example,
`NT AUTHORITY\LocalService`, `NT AUTHORITY\NetworkService`.

- `oom_score_adj` - (Optional) A positive integer to indicate the likelihood of
  the task being OOM killed (valid only for Linux). Defaults to 0.

- `work_dir` - (Optional) Sets a custom working directory for the task. This
  must be an absolute path. This will also change the working directory when
  using `nomad alloc exec`.

- `denied_envvars` - (Optional) Passes a list of environment variables that
  the driver should scrub from the task environment. Supports globbing, with "*"
  wildcard accepted as prefix and/or suffix.

## Examples

To run a binary present on the Node:

```
task "example" {
  driver = "raw_exec"

  config {
    # When running a binary that exists on the host, the path must be absolute/
    command = "/bin/sleep"
    args    = ["1"]
  }
}
```

To execute a binary downloaded from an [`artifact`](/nomad/docs/job-specification/artifact):

```
task "example" {
  driver = "raw_exec"

  config {
    command = "name-of-my-binary"
  }

  artifact {
    source = "https://internal.file.server/name-of-my-binary"
    options {
      checksum = "sha256:abd123445ds4555555555"
    }
  }
}
```

[hardening]: /nomad/docs/deploy/production/requirements#user-permissions
[service]: /nomad/docs/deploy/production/windows-service
[plugin-options]: #plugin-options
[plugin-block]: /nomad/docs/configuration/plugin
